AI Agents Moved the Robot Arm: Modelling OT Attack Paths as Graphs

The scenario is not hypothetical. Inside an isolated operational-technology (OT) lab built to mirror a manufacturing plant, a frontier AI model crossed the perimeter and moved a robotic arm within minutes — without ever being handed a network diagram, an engineering drawing, or the name of a single device.

Booz Allen published the results on 8 October 2026 in Super Intelligence Reaches OT Systems, alongside The Offensive Frontier: AI as the Attacker. Eight frontier models were run against a multi-vendor industrial estate across eight controlled scenarios. Every scenario's objective was achieved. No model needed source code, protocol documentation, or OT-specific guidance to get there. That is the part defenders should sit with: the barrier to entry is no longer domain expertise — it is a prompt.

What the lab actually contained

The testbed was a faithful slice of a real plant, not a capture-the-flag network. It followed the classic layered model, with assets spread across four zones:

Layer	Typical components
Enterprise	Corporate network, identity, remote access
Industrial DMZ	Jump hosts, historians, patch and proxy servers
Plant operations	SCADA platform, engineering workstations, HMIs
Production	PLCs, variable-frequency drives, a robotic arm, sensors

The offensive run started on the enterprise side and ended among the controllers. Total elapsed time to first action inside the industrial control network: about sixteen minutes.

The kill chain, reconstructed

Three moments in the report deserve to be read slowly.

First, the SCADA operator-display takeover. The agent initially targeted the wrong build of the operator interface. Rather than fail, it enumerated active sessions, identified the version actually running in the control room, located editable code inside an exported SCADA project, rebuilt a payload against it, and executed a full-screen takeover of the operator display. No human prompting at any step.

Second, the discovery of a SCADA gateway holding live, pre-authenticated sessions to fourteen OT devices across two zones. The agent did not need to defeat authentication; it inherited it.

Third, the unprompted ARP manoeuvre. A safety-critical device had been broadcasting an unanswered ARP request for over forty-five minutes. The agent recognised it could answer that broadcast, impersonate the missing peer, and receive whatever protocol session the device would then open. It flagged this — a textbook adversary-in-the-middle — without being asked to look for it.

These map cleanly onto MITRE ATT&CK for ICS: T0830 (Adversary-in-the-Middle), T0848 (Rogue Master), T0883 (Internet Accessible Device), T0886 (Remote Services), T0822 (External Remote Services). The novelty is not the technique set; it is that a general-purpose model selected and sequenced them autonomously.

Why this is fundamentally a graph problem

An OT estate is not a list of devices — it is a network of reachability, trust, and protocol relationships, layered across the Purdue model and partitioned into IEC 62443 zones and conduits. Attackers traverse it edge by edge. Defenders, too often, still reason about it as flat inventory.

The right mental model is the attack-path graph: a directed acyclic graph that extends an attack tree, where nodes are assets or states and edges are exploitable relationships. Bayesian attack graphs add a probability to each edge, which turns "is this path dangerous?" into "what is the cumulative likelihood of reaching physical consequence?"

That last phrase is the one Booz Allen emphasises. The question is not "how many critical devices do we own?" but "which paths terminate in an action with physical consequence?" — a controller write, a drive command, a valve state change. Prioritising by that criterion is exactly what a graph traversal gives you for free.

Building the attack-path graph

Start with the assets and their zone membership, then add reachability edges. A Neo4j model puts the Purdue level and IEC 62443 zone on each node, and the exploitation probability on each relationship:

// Which paths reach a safety-critical controller, and how likely are they?
MATCH p = (entry:Asset {zone: 'Enterprise'})
          -[:CAN_REACH*1..6]->
          (plc:Asset {purdueLevel: 1})
WHERE plc.safetyCritical = true
RETURN [n IN nodes(p) | n.name]        AS attackPath,
       reduce(r = 1.0, rel IN relationships(p) | r * rel.probability)
                                        AS cumulativeRisk
ORDER BY cumulativeRisk DESC
LIMIT 10

The asset-relationship layer is where most teams are weakest. It has to capture dual-homed hosts, shared services, and — the killer detail from the report — pre-authenticated sessions. A live session on a gateway is a reachability edge that no firewall rule documents.

Two open-source tools shorten the path from inventory to graph. norwytch/ics_attack_surfaces takes a YAML description of a plant and emits an attack graph annotated with MITRE ATT&CK for ICS, NIST SP 800-30 scoring, and IEC 62443 zone/conduit relationships — plus an ATT&CK Navigator layer you can drop straight into a workshop. aakashsingh-sec/ot-segmentation-validator encodes ten Purdue and IEC 62443 segmentation rules and rates exposure by traversing the graph outward from the enterprise/DMZ boundary. For fully rule-driven generation, MulVAL remains the reference point: it expresses exploit preconditions as Datalog derivation rules and produces the graph from system facts.

# Minimal YAML shape for a graph generator (ics_attack_surfaces-style)
assets:
  - id: hmi-control-room
    zone: plant-operations
    purdue: 2
    services: [rdp, scada-client]
  - id: plc-line-1
    zone: production
    purdue: 1
    safety_critical: true
conduits:
  - from: industrial-dmz
    to: plant-operations
    allows: [rdp]

Where detection has to sit

If the agent's advantage is speed and autonomy, detection cannot depend on a human reading logs. The report's defensive recommendations translate almost directly into graph queries and standing alerts:

• Monitor controller-mode changes, program writes, and SCADA project imports — these are the high-consequence edges, not routine network traffic.
• Alert on unexpected use of trusted interfaces, including jump hosts and engineering workstations.
• Track ARP anomalies: an unsolicited reply from a peer that was previously silent is the T0830 signature that preceded the agent's manoeuvre.
• Remove or tightly constrain dual-homed systems, shared services, and pre-authenticated sessions, then re-run the traversal to confirm the shortest path to physical consequence grew longer.

A useful operational loop is to score the graph nightly with FIRST EPSS and CISA KEV data, and to re-score it whenever the asset inventory changes. Attack-path risk is not a static property of a device; it is a property of the path.

What held — and what did not

Not every control failed. One controller rejected a stop command it judged unsafe. A motor set to local-control mode could not be started remotely. Firewalls, segmentation, and endpoint protection slowed or blocked individual actions. The uncomfortable finding is that no single safeguard consistently stopped the models. Segmentation raised cost; it did not impose a wall.

The report also notes, from the Cyber Weapon Index work, that only one of eighteen tested models currently executes the full cyber kill chain autonomously, but that most are close, and Booz Allen assesses broad parity within roughly six months. It further observes that the harness around a model can matter as much as the model itself — a point worth remembering, because it means a defender's exposure can change with an attacker's tooling, not only with a new model release.

The takeaway for defenders

Agentic attackers collapse the time between discovery and action. The countermeasure is not a bigger firewall; it is a live, queryable model of your own attack surface, prioritised by the paths that end in physical consequence. Build the graph, attach probabilities, and monitor the edges that matter — controller mode, program writes, project imports, and the quiet ARP that should not be there.

The lab models did in minutes what used to require a specialist with weeks of reconnaissance. If you cannot answer "what is our shortest path from the internet to a safety-critical controller?" with a query, you do not yet have the picture the attackers already do.